From b9a0086975fa966bf113db2d853bd978c4498475 Mon Sep 17 00:00:00 2001 From: Hanno Becker Date: Tue, 28 Aug 2018 10:20:22 +0100 Subject: [PATCH] ssl-opt.sh: Explain use of --insecure in GnuTLS client tests --- tests/ssl-opt.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index ff36e6c57..01867e1fd 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -5535,6 +5535,13 @@ run_test "DTLS fragmenting: gnutls server, DTLS 1.0" \ -c "fragmenting handshake message" \ -C "error" +# We use --insecure for the GnuTLS client because it expects +# the hostname / IP it connects to to be the name used in the +# certificate obtained from the server. Here, however, it +# connects to 127.0.0.1 while our test certificates use 'localhost' +# as the server name in the certificate. This will make the +# certifiate validation fail, but passing --insecure makes +# GnuTLS continue the connection nonetheless. requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C @@ -5549,6 +5556,7 @@ run_test "DTLS fragmenting: gnutls client, DTLS 1.2" \ 0 \ -s "fragmenting handshake message" +# See previous test for the reason to use --insecure requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_ECDSA_C